255 reputation
314
bio website google.com
location Poland
age 94
visits member for 4 years, 10 months
seen Jul 1 at 14:19

Ha!


May
4
accepted Ubuntu 10.10 x86_64 2.6.35-28 - possible memory leak - slabs slowly eating memory
Apr
21
answered Ubuntu 10.10 x86_64 2.6.35-28 - possible memory leak - slabs slowly eating memory
Apr
14
revised Ubuntu 10.10 x86_64 2.6.35-28 - possible memory leak - slabs slowly eating memory
added 171 characters in body
Apr
12
comment Ubuntu 10.10 x86_64 2.6.35-28 - possible memory leak - slabs slowly eating memory
No virtualization at all on this box. First I though it was related to lkml.org/lkml/2010/9/27/387 but looks like its not a DRM issue. Now it looks like noapic fixed the issue. Box is running with noapic and slub_debug for couple of hours now, and there is no leak whatsoever. I am going to verify that sometime tommorow, by juggling this option back and forth. Issue is clearly detectable after like 5 mins already
Apr
12
awarded  Commentator
Apr
12
asked Ubuntu 10.10 x86_64 2.6.35-28 - possible memory leak - slabs slowly eating memory
Apr
5
awarded  Tumbleweed
Mar
31
awarded  Critic
Jan
24
comment How to cleanly and silently reload iptables rules?
I don't find this case any extreme. Parsing "-L" output for entries isn't a trivial task. Aside from that, there there is no need to overcomplicate things like this. First of all there is "-R" for replace available. Second, it would be trivial just to add all rules at the end, then remove old rules from start. Unfortunetely this wont work due to problems referenced in other answers / comments.
Jan
21
comment How to cleanly and silently reload iptables rules?
@packs It does not matter. All start-up scripts do is wrapping iptables-save/restore in some custom manner. As I pointed out before, I am using custom shell script, so - again - it doesn't matter in this case. In case you are dying to posses this knowledge - we are using Debian.
Jan
21
comment How to cleanly and silently reload iptables rules?
Well, I never thought that iptables-save and ipset -S are any different than just simple flush and rebuild of ruleset. I will look into this, thanks for the tip.
Jan
21
comment How to cleanly and silently reload iptables rules?
Well, it even makes sense to create a new chain and replace the main hook point (iptables -R). This however won't work with ipset, since you can't remove ipset until it is referenced by iptables rule. In the end it pretty much comes down to the original idea - Append the rules at the end, then remove the old rules one-by-one. This can work in theory, but requires a major overhaul in our approach. Perhaps we should gave up on stuph like many custom chains or ipsets, to reduce complexity. Before that decision I would like to know if someone can suggest something less invasive.
Jan
21
comment How to cleanly and silently reload iptables rules?
@Phil Mentioned Boxes are running BGP/IGP, IPSEC, LVS, policy routing and more layer 3 stuffh. Filtering is very complicated, mostly based on markings. Because several people maintain the environment, we have unified diffs generated between commits. Thus there is 4+ year old history of changes available. Equivalent functionality from Cisco/Juniper would cost us hundred of thousands of bucks in hardware and migration costs. I am sure parts of the stuff wouldn't be even possible to recreate with networking vendor hardware.
Jan
21
comment How to cleanly and silently reload iptables rules?
@packs The distribution doesn't really matter here. I am not using anything specific to any distribution. Set of rules in contained in a lsb-like custom start script.
Jan
21
awarded  Editor
Jan
21
revised How to display interface in tcpdump output flow?
Added clarification
Jan
21
awarded  Autobiographer
Jan
21
asked How to cleanly and silently reload iptables rules?
Jan
21
comment How to display interface in tcpdump output flow?
I really need this functionality very often. I have several interfaces, lots of vlan interfaces, with IGP and BGP on top of this. Finding out how the packets are flowing is essential very often. I can manually check the outbound interface by examining the current routing table. But if I have to find the way packets are coming from the internet, sometimes I have to do blind checking, just by starting tcpdump on most probable interfaces. :(
Jan
20
awarded  Student